External risk intelligence

Better-Auth Insecure Cryptographic Defaults Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-67336

The vulnerability exists in an authentication library (better-auth) specifically within OIDC provider and plugin implementations. Authentication services and OIDC providers are, by design, internet-facing components that handle identity and public web/API traffic, making this surface exposed by default in any deployment that utilizes these features.

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a vulnerability in the better-auth authentication library, specifically affecting its OIDC provider and MCP plugins. The issue stems from insecure cryptographic defaults that could allow attackers to bypass security controls, potentially leading to unauthorized access. The main concern is confirming relevance and exposure within your specific environments.

Flaw allows bypassing security with weak defaults.
Authentication libraries are critical for access control.
Confirm if this library is used and its configuration.

Attack Path

How an attacker could exploit the issue

An attacker could exploit vulnerabilities in the authentication library's OIDC and MCP plugins by initiating a connection and manipulating the negotiation process. This manipulation could allow the attacker to bypass standard security checks, leading to the acceptance of unsigned tokens or the interception of authorization codes, which are intended to be protected. The specific attack path is not fully detailed in the provided context.

Requires network access and attacker control of the network.
Triggers by exploiting algorithm negotiation or PKCE plain usage.
Allows unsigned tokens or intercepted authorization codes.

Live Threat

Current exploitation, exposure, and threat context

Insecure cryptographic defaults in the `oidcProvider` and `mcp` plugins could allow attackers to bypass authentication by accepting unsigned tokens or intercepting authorization codes. This could occur when the system negotiates the `none` algorithm or uses plain PKCE instead of the more secure `S256` method.

System authentication data could be compromised.
Attackers may intercept authorization codes.
Bypassed authentication could lead to unauthorized access.

Operational Fix

Recommended remediation, mitigation, and detection steps

The security of the OIDC provider and MCP plugins in better-auth requires attention from teams responsible for authentication services, identity management, and application development. The initial step is to inventory all instances of better-auth, determine their exposure, and identify business-critical applications that rely on them. This will inform the prioritization of remediation efforts, involving coordination with development and potentially vendor management if a third-party solution is impacted.

Application and platform teams own resolution.
Verify OIDC provider and MCP plugin usage.
Plan remediation based on exposure and criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is better-auth?

better-auth is an authentication library used by developers to handle identity management, user sessions, and secure login workflows within their applications. It provides pre-built components like OIDC providers and plugins that simplify how applications verify user identities and manage authorization tokens. By integrating this library, developers avoid writing complex cryptographic protocols from scratch, relying instead on its built-in modules to secure communication between their software and its users.

What does CVE-2026-67336 mean for security?

This vulnerability, classified as CWE-327 (Use of a Broken or Risky Cryptographic Algorithm), highlights a weakness in how the software handles cryptographic settings. By defaulting to insecure options like the 'none' algorithm for tokens or plain PKCE, the library fails to enforce strong security. This allows an attacker to manipulate the authentication handshake, potentially tricking the system into accepting unverified identity tokens or exposing sensitive authorization codes.

How is this vulnerability triggered?

An attacker triggers this by intervening during the authentication handshake between a client and the OIDC or MCP implementation. They exploit the library's willingness to negotiate insecure parameters, such as requesting the 'none' algorithm or forcing the use of plain PKCE instead of the required S256 method. It is important to note that if your implementation explicitly forces secure cryptographic standards and rejects these fallback options, the flaw may not be reachable in the same way.

Is my system at risk?

If you use better-auth, you are potentially affected. According to Halo Surface Signal, because this library powers OIDC providers and authentication services—which are designed to be internet-facing to process web and API identity traffic—this vulnerability is highly relevant to any public-facing application utilizing these specific plugins. You should assume this is an external-facing concern if your authentication service is reachable via the public internet.

Do I need to update my software?

Your first step is to perform an inventory of your environment to identify every application utilizing better-auth. Focus specifically on whether those applications use the affected OIDC provider or MCP plugin features. Once identified, consult the library's official guidance to verify your version; applications running versions before 1.6.11 should be prioritized for remediation by your development or platform teams to ensure secure cryptographic defaults are enforced.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.